Report Finds Increasing Number of Vulnerabilities in OpenVPN

OpenVPN, an open source virtual private network (VPN) system integrated into millions of routers, firmware, PCs, mobile devices and other smart devices, is leaving users open to a growing list of threats, according to a recent report from Microsoft.

The company released a security report detailing some of the latest holes in the open source service, and is warning that many of these vulnerabilities could be used in conjunction "to achieve an attack chain consisting of remote code execution (RCE) and local privilege escalation (LPE)." The report was compiled after Microsoft discussed a handful of new OpenVPN holes during a session at Black Hat USA 2024.

Microsoft initially reported these vulnerabilities to OpenVPN in March 2024 through Coordinated Vulnerability Disclosure (CVD) via the Microsoft Security Vulnerability Research (MSVR) team. Following this, Microsoft and OpenVPN worked together to patch the vulnerabilities, culminating in the release of OpenVPN 2.6.10.   

The discovered vulnerabilities include:

  • CVE-2024-27459: Affects the openvpnserv component, leading to potential denial of service (DoS) and local privilege escalation (LPE) in Windows.
  • CVE-2024-24974: Also within openvpnserv, this vulnerability allows unauthorized access to Windows.
  • CVE-2024-27903: This flaw can result in remote code execution (RCE) on Windows and LPE or data manipulation on Android, iOS, macOS and BSD.
  • CVE-2024-1305: Affects the Windows TAP driver, leading to a potential DoS on Windows.

"All the identified vulnerabilities can be exploited once an attacker gains access to a user's OpenVPN credentials, which could be accomplished using credential theft techniques, such as purchasing stolen credentials on the dark web, using info-stealing malware, or sniffing network traffic to capture NTLMv2 hashes and then using cracking tools like HashCat or John the Ripper to decode them," wrote the Microsoft Threat Intelligence team.

What's interesting is that the discovered vulnerabilities all can be found on the client side. Microsoft stressed that OpennVPN's server is secure, and discovered no holes on that side of the equation.

Microsoft reported these vulnerabilities to OpenVPN in March 2024 through Coordinated Vulnerability Disclosure (CVD) via the Microsoft Security Vulnerability Research (MSVR) team. Following this, Microsoft and OpenVPN worked together to patch the vulnerabilities, culminating in the release of OpenVPN 2.6.10.  However, Microsoft said that users are strongly urged to apply the latest security updates to mitigate potential risks as soon as available.

Microsoft advises organizations using OpenVPN to verify their versions and apply the necessary patches immediately. In addition, ensuring strong credential management and limiting access to VPN services can further mitigate potential risks.

For more information, visit the Microsoft blog post.

About the Author

Chris Paoli (@ChrisPaoli5) is the associate editor for Converge360.

Featured

  • stylized illustration of an elementary school classroom under construction

    4 Educators Win Classroom Makeovers in KI Giveaway

    Furniture manufacturer KI has announced the results of its third annual Classroom Furniture Giveaway.

  • person signing a bill at a desk with a faint glow around the document. A tablet and laptop are subtly visible in the background, with soft colors and minimal digital elements

    California Governor Signs Off on AI Content Safeguard Laws

    California Governor Gavin Newsom has officially signed a series of landmark artificial intelligence bills into law, signaling the state’s latest efforts to regulate the burgeoning technology, particularly in response to the misuse of sexually explicit deepfakes. The legislation is aimed at mitigating the risks posed by AI-generated content, as concerns grow over the technology's potential to manipulate images, videos, and voices in ways that could cause significant harm.

  • glowing digital padlock at the center, surrounded by interlocking circuit-like patterns that form the shape of a school building

    FCC Cybersecurity Pilot Update: Administrative Window Opens Aug. 26

    The Universal Service Administrative Co. (USAC) has just released information on how to begin making administrative updates to prepare the user permissions necessary for the Federal Communications Commission Schools and Libraries Cybersecurity Pilot Program.

  • close-up illustration of a hand signing a legislative document

    California Passes AI Safety Bill, Awaits Governor's Signature

    California lawmakers have approved a bill that would impose new restrictions on AI technologies, potentially setting a national precedent for regulating the rapidly evolving field. The legislation, known as S.B. 1047, now heads to Governor Gavin Newsom's desk. He has until the end of September to decide whether to sign it into law.